CVE-2023-34991: 
FortiWLM vulnerability analysis and mitigation

A critical SQL injection vulnerability (CVE-2023-34991) was discovered in Fortinet FortiWLM versions 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.4.0 through 8.4.2, 8.3.0 through 8.3.2, and 8.2.2. The vulnerability allows an unauthenticated attacker to execute unauthorized SQL queries via a crafted HTTP request due to improper neutralization of special elements used in SQL commands (Fortinet Advisory, NVD).

The vulnerability (CWE-89) exists in the FortiWLM web interface and allows attackers to inject malicious SQL queries through crafted HTTP requests. The issue stems from insufficient input validation in the application's SQL query handling. The vulnerability has received a Critical CVSS v3.1 base score of 9.8, indicating the highest severity level (NVD, Fortinet Advisory).

When successfully exploited, this vulnerability allows attackers to execute unauthorized code or commands on the affected system. Given the critical nature of FortiWLM in managing wireless networks across enterprise environments, particularly in universities, hospitals, and large office settings, the potential impact is severe (Horizon3).

Fortinet has released patches to address this vulnerability. Organizations running FortiWLM 8.6.0-8.6.5 should upgrade to version 8.6.6 or above. Those running 8.5.0-8.5.4 should upgrade to version 8.5.5 or above. Users of FortiWLM 8.4, 8.3, and 8.2 versions should migrate to a fixed release (Fortinet Advisory).